82720e7282d087581abf9ddf23bbd3e3a8ffb1946262ca416fb72994bb6a3402

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Size 18.4MB
Sample260813-e3gmaazxbv
SHA256 82720e7282d087581abf9ddf23bbd3e3a8ffb1946262ca416fb72994bb6a3402
MD5 802b8008d3cfc37169e1465239931b2b
SHA1 292420718d63241137300a9ce719ce7f8a2aaf07
SHA512 a4b37160116b10f3d4c3262434befdfba7eb6e9c99a978e87124e02912e4091f0df7d9c6f39eb312d1918736849993d9d74417a09f17cca7cb2ff0348a552107
SSDEEP 98304:InZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5aD:MqtqtqtqtqtqtqtquFIF0wuM
TLSH
T19F179E05F2D600B5E5B32570496B927A897A7A314731C9DFA388C53E9F33EC0A938B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3920	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
4268	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
1268	svchost_AAACBBBBAABCABAABBCABAABBCABABCBCCBCAAACBCBABACACCABABC.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCBCACABBCBCCAAACBABACBCBCCBAABABAAAAACBBCBCBCCAABCACABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe"	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBCCACAACCBCCBCBCBCABBBAACCBBCBCBBCCBACABACCCBCCCACACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBBBBAABCABAABBCABAABBCABABCBCCBCAAACBCBABACACCABABC.exe"	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2472	sc.exe
3880	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4832	cmd.exe
1396	cmd.exe
4724	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBBBBAABCABAABBCABAABBCABABCBCCBCAAACBCBABACACCABABC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
3920	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
3920	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
3920	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
3920	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
4268	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
4268	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Token: SeDebugPrivilege	3920	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
Token: SeDebugPrivilege	4268	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4264	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 4832	4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	96
PID 4832 wrote to memory of 4872	4832	cmd.exe	98
PID 3920 wrote to memory of 692	3920	svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe	99
PID 692 wrote to memory of 864	692	notepad.exe	100
PID 4600 wrote to memory of 1396	4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	102
PID 1396 wrote to memory of 2472	1396	cmd.exe	104
PID 4600 wrote to memory of 4724	4600	2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe	105
PID 4724 wrote to memory of 3880	4724	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_802b8008d3cfc37169e1465239931b2b_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACCACCBCCCAABABCCAAAACCABBCCBAABAACBCACABBAABBACCBACAACAABBCBACACCBCBCABBAACACAABCCCAACCABCCBABAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCACCACCBCCCAABABCCAAAACCABBCCBAABAACBCACABBAABBACCBACAACAABBCBACACCBCBCABBAACACAABCCCAACCABCCBABAABCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBBCACCCAACABBCCCBBBCACAAABBBABCACCBBBACABBCBABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe" start= auto displayName= "UserDataSvc_ABCBBCACCCAACABBCCCBBBCACAAABBBABCACCBBBACABBCBABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBBCACCCAACABBCCCBBBCACAAABBBABCACCBBBACABBCBABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe" start= auto displayName= "UserDataSvc_ABCBBCACCCAACABBCCCBBBCACAAABBBABCACCBBBACABBCBABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBBCACCCAACABBCCCBBBCACAAABBBABCACCBBBACABBCBABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBBCACCCAACABBCCCBBBCACAAABBBABCACCBBBACABBCBABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:864

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBAABCABAABBCABAABBCABABCBCCBCAAACBCBABACACCABABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBBBBAABCABAABBCABAABBCABABCBCCBCAAACBCBABACACCABABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 dbe35b85637d197aea43e198c8f89e5e9e0e5e60e7d6358d7871a4c04588069b
MD5 9ca0919c3e63fbeb95a305528a1f574b
SHA1 8a2e795e73769b222ed11c8f47e5535f50312f88
SHA512 9d7a5f7e09c71ac437fe1e229870dc7c42cdf07a1d65c658b0e842b106e2b8e27298d13903b0dc6ee055ccb993c324efdb8c534d1e43e979a7ab98f5cd738e2d
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe
Size 18.8MB
SHA256 14d336b5bab01efe938cd592e4b947d1291659eba9b8c0fe50dfae1bbbf197c0
MD5 7b281cbc2041253ded847aab53cbddbe
SHA1 fc56ed43328dae49635b3504450710fefa00d719
SHA512 086d6441b2bcbbfc8e02c99e3eb9d223360b23f14860c78a2571dbd8b92c5320895c3fba3be8014c0bb9bf9d1b24f412b5214cc7f462c304813ca4785bf03ada
SSDEEP 98304:InZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5aZ:MqtqtqtqtqtqtqtquFIF0wus
TLSH
T12A179E05F2D600B5E5B3257049AB927A897A79314731C9DFA3C8853E9F33EC0A938B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\Temp\DiagTrackTraceSlot_alternativeTrace\qap`g`v~dtlq
Size 10B
SHA256 39811bde3f91d13743c524a25cefca9274545fcc06b630b1dbc25bf14d3079e3
MD5 6f485e888eb810466a016076dfc49877
SHA1 041c2bf473de8ee5be5f41fab8d6302acd04e0d6
SHA512 c047a27a8996c8adbc838f1e0172996c28e7ceb54946d33c99ab71da5722ee979ade1e079a9ffc92859053a53e77dacaadf46a053d14babdcc3239958e5a5e20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{8731E6E3-AF96-4515-ACEC-DBFB3DF55292}v64.60.31149\qap`g`v~dtlq
Size 10B
SHA256 04fbe31f7c0387312fae9f27171d32652eceba290fd320fce80a7c9e19445f16
MD5 d1f7797bdab0fc4efdae423e0ff23e1c
SHA1 ddb76c2ff426dad54a705978f645c4e93a4bdd8d
SHA512 8e8e066243d3958fa26fcc374c1a50d21e4d4d18a90ab53f14f867399491582aa045a572897c985212b07bb31fa265473ed6d1956087df04b3cbf686c697a66b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\gu\qap`g`v~dtlq
Size 10B
SHA256 0144420942995eb903d79c1913be0108ab31ff1465979e7fdc3c117de468e061
MD5 18dbab4885aeeefac021f3248013d393
SHA1 ea2b9e287c116089b63647230a26449539cad70b
SHA512 696923fe14756abf7f12c09c214a2cc6c9529b0c8c89ea58f197648594521e1fbbb6b4dca6945efc7f98d624ea3c68bda3a3ec36d417c2227569f1192c723684
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 688b5b33b3aa8b0869acc4eb42ad267e9fb4560a0b52bae197390180f60aeabc
MD5 881c828001370ed4f752bbbd85b4a112
SHA1 d2ec3f10abd12c8dd661fa96e8f2e123e693bbd2
SHA512 d7f2282f07d25b58963bb92a1e167b11c4a7bad83a197d11683cb1e1a990a73397f16534a7516f1c441553eeaac74d7401cefec4737e1b30d1336087ca1557a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 206ad39d5cdd638b484576f5f33433356b807dfc62c81dd1fcc40ec8a5cae35a
MD5 edd09d437bf5706d6e273b15d6153a82
SHA1 923ae0ddf124ff6d8156f8ad4f50944c969d947c
SHA512 d018232d150e71a171ad0013e2642c79ad9821f8618b0051f12594bbe4745583c03ddfcf18f66bffcd1409f1402fa7f390a3b381106e4068de024b022c1bc5ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ce120055e788f89f54dd4b0ba06aeb831307c74f284b31741aab9a85bf052504
MD5 5203cb79f1b9261c805044ceb58bf80e
SHA1 96d3b58cf940b24c4bf03bf165a6ce8446215e49
SHA512 155d90a38012be832fcb06e1f4edb5f9beeba3644219f10763f8946a860faeb26c25fcedca63564d1ed858d5cafeb3c8dfe71991e3be18f5cf6814fadbaedffd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d75eee151c25472390f874d438eb8a5aa7f48536b77067db9875f1b109939e76
MD5 d16113465f7ed35b0369bc3c978bef75
SHA1 93889a14ecdc37fe188809414c19b41dad563f21
SHA512 7dd165e9d2283c6741e8cb2855680e3bbf511705b3701aded03b70f3ecb1d0cb450217930d57d8863bd9aa86804f7d4959252eec727c2828ecca622563568f5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 06e0e9a90ee0404c3bb03faf7d0999eb2bbdbf400bdf47343c41b773f3ac18d5
MD5 ac581cdf001b01d56b94ce0fa3aff307
SHA1 205b1608e1bebf844aa114f801e035e360d0ec18
SHA512 1ac373da78b4569c55dfd9f0b1901a6489c9536bd35356736f52e1690895e31003c258abd66e23a484715fb7fffe6ccce03c6461c9f03a1f18a1475fee20b28e
MD5 SHA1 SHA512

Submit Download

svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACABACCBCAAABCCBBABBAACCCCBCCABACBBCBBCBBACAAAACB.exe
Size 18.4MB
SHA256 82720e7282d087581abf9ddf23bbd3e3a8ffb1946262ca416fb72994bb6a3402
MD5 802b8008d3cfc37169e1465239931b2b
SHA1 292420718d63241137300a9ce719ce7f8a2aaf07
SHA512 a4b37160116b10f3d4c3262434befdfba7eb6e9c99a978e87124e02912e4091f0df7d9c6f39eb312d1918736849993d9d74417a09f17cca7cb2ff0348a552107
SSDEEP 98304:InZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5a2nZKRuy5aD:MqtqtqtqtqtqtqtquFIF0wuM
TLSH
T19F179E05F2D600B5E5B32570496B927A897A7A314731C9DFA388C53E9F33EC0A938B57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 780B
SHA256 8d952d54669b3fa5af1e56bd4768ae0544372dce58018c8a9d657fa9ceb6eeac
MD5 3cdbb0e7dc6df91ba2709141296bf394
SHA1 e0d9125372eb2eeabc176878894093c9b76cee84
SHA512 cecfb932ced3bd3003e6bce3bf41496497b702fa289cc6f2a1aaace0d4e51795a0779d6c27bd9e54fec68a29a388e87721ab123d5600924781a1510bc5675e2c
TLSH
T102014E12ECE6E857F93368CB532A9AC30CE536D7645C7B481305020DABD4D72CE550A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/692-59-0x0000000005A20000-0x0000000005A21000-memory.dmp

Download

memory/1268-79-0x0000000000110000-0x0000000000131000-memory.dmp

Download

memory/3920-38-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/3920-25-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4268-74-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4268-188-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4600-6-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download